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IN THE UNITED STATES COURT OF FEDERAL CLAIMS 

Bid Protest 


FILED 

OCT 2 9 2010 


U.S. COURT OF 
FEDERAL CLAIMS 


GOOGLE, INC. 

1600 Amphitheatre Parkway 
Mountain View, CA 94043, 

and 

ONIX NETWORKING CORPORATION 
26931 Detroit Road 
Westlake, OH 44145, 

Plaintiffs, 


v. 

THE UNITED STATES, 

Defendant. 
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COMPLAINT 


Plaintiffs Google, Inc. ("Google") and Onix Networking Corporation ("Onix"), by and 
through their undersigned Attorney of Record, upon personal knowledge as to themselves, their 
own acts, and the contents of the documents referred to herein, and upon information and 
belief as to all other matters, hereby bring this bid protest action against Defendant, The 
United States of America, and for their Complaint alleges as follows: 

NATURE OF THE ACTION 

1. This action protests the terms of U.S. Department of the Interior (“DOI”) 
Request for Quotation No. 503786 (the “RFQ”) for hosted email and collaboration services and 
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DOI’s supporting “Limited Source Justification,” and seeks preliminary and permanent 
injunctions against the DOI proceeding with the RFQ, or any related procurement, solicitation or 
task order, without first complying with applicable statutory and regulatory requirements, 
including but not limited to conducting a competition in accordance with applicable law and 
regulations to select a hosted email and collaboration solution that best satisfies DOFs minimum 
needs. 

JURISDICTION 

2. This Court has jurisdiction over the subject matter of this Complaint pursuant 
to the Tucker Act, as amended by the Administrative Dispute Resolution Act of 1996, Pub. L. 
No. 104-320, § 12(a), (b), 110 Stat. 3870 (Jan. 3, 1996), codified at 28 U.S.C. § 1491(b)(1). 

THE PARTIES 

3. Plaintiff Google is a corporation organized and doing business under the laws of 
the State of Delaware with its principal place of business in Mountain View, California. Google 
is the developer and owner of computer software products and solutions, including its Google 
Apps Premier and Google Apps for Government messaging solutions, and Google licenses its 
products and solutions to customers either through direct agreements or Google's licensed 
resellers. 

4. Plaintiff Onix is a corporation organized and doing business under the laws of 
the State of Ohio with its principal place of business in Westlake, Ohio. Onix is a licensed 
reseller of Google products and solutions through its GSA Schedule 70 contract. 

5. Defendant, the United States of America, for all purposes relevant hereto, acted 
by and through the Department of the Interior ("DOI"), an agency of the federal government. 
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FACTUAL BACKGROUND 

Overview 

6. Because the DOI’s bureaus and offices were using many different messaging 
products, the DOI determined that it would acquire a single hosted email and collaboration 
services solution (“messaging solution” or “messaging requirement(s)”) to support its 
approximately 88,000 users throughout the agency. Before DOI issued the RFQ, Google 
representatives made numerous attempts to engage DOI in substantive discussions regarding the 
technical and cost-saving benefits of the Google Apps solution for DOFs messaging 
requirements. Google's objective was to have the opportunity to compete for DOFs messaging 
requirements. Notwithstanding Google’s efforts and DOFs assurances to Google representatives 
that DOI would conduct a full and open competition for its messaging requirements, the RFQ 
specified that only the Microsoft Business Productivity Online Suite-Federal (“BPOS-Federal”) 
could be proposed. DOFs restrictive specification was based upon a “Limited Source 
Justification” executed by DOFs Director, Office of Acquisition and Property Management, on 
August 30, 2010. Plaintiffs protest DOFs specification of the Microsoft BPOS-Federal solution 
on the grounds that such specification is unduly restrictive of competition in violation of the 
Competition in Contracting Act, 41 U.S.C. § 253a(a)(l)(A), and the DOFs “Limited Source 
Justification” constitutes a sole-source procurement that is arbitrary and capricious, an abuse of 
discretion, and otherwise contrary to law. 

Discussions Prior to DOFs Issuance of the RFQ 

7. In June 2009, Google representatives met with the DOI Chief Technology Officer 
(“CTO”), who outlined the general functional requirements that DOI had defined to meet its need 
for an improved e-mail, calendaring and collaboration system. Google confirmed that all 
outlined needs could be met with its Google Apps product, and requested an opportunity to meet 
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again with DOI to further discuss DOI’s needs in greater detail and to provide DOI with a fuller 
understanding of the technical and security aspects of the Google Apps solution. No meetings on 
this topic were held between Google and DOI until February 2010, when DOI representatives 
accepted a Google request for an executive introductory meeting. The agenda included 
executive introductions, an update on the Federal Information Security Act (“FISMA ’) 
certification status of Google’s Messaging solution, Google Apps, for federal government use, 
and Google’s request to meet further for more detailed discussions. 

8. Despite repeated requests and offers from Google for such detailed discussions, 
the next follow-up from DOI was acceptance of an invitation to a public Google session in April 
2010 where Google provided information about its enterprise computing vision, why large 
organizations have selected Google’s technology and the benefits they have experienced, and 
how to begin a cloud computing initiative at a federal agency. The public session was attended 
by then-U.S. Fisheries and Wildlife Service Chief Information Officer (“CIO”), Mr. Bernard 
Mazer (who subsequently became the DOI CIO), and the DOI CTO, Mr. William Corrington, 
who informed Google that a “path forward had already been chosen” for the DOI Messaging 
solution and there would be no opportunity for Google to compete because its product was not 
compliant with DOI’s security requirements. Despite Google’s many requests for such 
information, DOI declined to define its security requirements or to meet with Google to conduct 
more detailed discussions about Google Apps, including a full review of Google s security 
documentation. 

9. Google then contacted the DOI’s National Business Center’s Chief Contracting 
Officer, Ms. Debra Glass, by sending her a formal letter of interest on May 17, 2010. That letter 
expressed Google’s keen interest in competing for DOFs Messaging solution, and outlined the 
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technological and financial advantages of the Google Apps solution. Google also expressed its 
view that a solicitation with brand-name specific requirements would violate CICA’s 
requirements and would unfairly preclude the offer of Google Apps or any other competitive or 
innovative software product. See Exhibit A attached hereto. 

10. On May 27, 2010, Ms. Glass sent Google a letter that did not respond to or 
reference Google’s May 17 letter, but instead requested that Google respond to fifteen broadly- 
worded requirements to “enhance” the DOI’s market research. Those questions notably 
requested a discussion of Google’s “[ajbility to meet FISMA security certification requirements” 
and Google’s “[ajbility to provide an underlying infrastructure that is operated solely for DOI.” 
The letter claimed that market research had been conducted by DOI between October 2009 and 
March 2010. 

11. On June 9, 2010, Google met with DOI representatives in an effort to "enhance” 
the DOI’s market research. Those attending from DOI included: Mr. Andrew Jackson, Deputy 
Assistant Secretary for Technology, Information and Business Services; Ms. Debra Sonderman, 
Director, Office of Acquisition and Property Management; Mr. Mazer; and Mr. Corrington. 
During the meeting, Mr. Jackson stated that DOI had previously standardized on Microsoft 
solutions, but he claimed DOI was nevertheless committed to conducting a lull and open 
competition. In turn, Google explained how its product would satisfy each ol DOI s 

requirements outlined in the May 27, 2010 letter. 

12. The DOI representatives expressed some concern regarding whether Google 

could provide an underlying infrastructure that was operated solely for DOI. Google explained 
that the service for DOI can be isolated to a single domain that is run on a logically separate 
network. Further, Google explained how its Government-only cloud (reserved for federal, state, 
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and local governments) would sufficiently address DOFs concerns. Google also requested that 
DOI provide a comprehensive list of objectives and requirements to which Google could 
respond; however, DOI never provided such information to Google. 

13. Google followed up this meeting with another letter addressed to Mr. Jackson on 
June 17, 2010. See Exhibit B attached hereto. Google enclosed with the letter written 
documentation demonstrating that Google Apps could meet or exceed each of the requirements 
described in DOI’s May 27, 2010 letter. Regarding DOFs alleged need for an underlying 
infrastructure operated solely for DOI, Google explained that such a “private cloud” was not 
required for security certification under FISMA and, similar to GSA’s recent solicitation for 
“Enterprise E-Mail and Collaboration Services” from a commercial provider of Cloud 
Computing services and software, DOI could address its security requirements by requiring that 
the contractor “provide security controls that are confirmed to meet the security standards for 
Moderate Impact systems as described in NIST SP 800-53 with an accepted Certification and 
Accreditation (C&A).” Google also explained that DOFs requirement for a private cloud did not 
represent “industry best practice,” referencing examples of federal Government entities and 
major organizations that use Google Apps. Finally, since Mr. Jackson had referenced certain 
authority from a 2002 Microsoft standardization decision, Google reminded DOI that 
standardization decisions are not licenses to circumvent the CICA. 

14. DOFs Mr. Jackson responded to Google’s letter by email on June 18, 2010 with a 

follow-up question and the following assurances: 

Also, I feel I need to clarify a misconception noted in your letter. 

As I stated last week, DOI has not finalized its procurement 
strategy for the planned cloud messaging solution. We continue to 
evaluate all options in light of our business requirements. 
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15. Similarly, Ms. Brigitte Meffert, DOI’s Competition Advocate, acknowledged her 
receipt of a copy of Google's June 17 letter, and she stated on behalf of the Office of Acquisition 
and Property Management that it was “confident that Google, and all interested parties, will be 
treated fairly during the process.” 

16. On June 23, 2010, Google answered Mr. Jackson's follow-up question, explaining 

that Google was committed to meeting federal security requirements and would commit to 

meeting any DOl-defined implementation timelines. In addition, Google alerted Mr. Jackson to 

rumors circulating in the industry that DOI had already selected a Microsoft product: 

Finally, we are encouraged by your clarification that the DOI has 
not finalized its procurement strategy for the planned cloud 
messaging solution and is continuing to evaluate all options in light 
of DOI’s business requirements. However, we believe you should 
know that we continue to hear very disconcerting rumors that 
project deployment activities are already underway to migrate the 
DOI to a pre-determined messaging solution notwithstanding the 
lack of any legitimate market research or a “full and open" 
competition for the DOFs messaging solution. We would therefore 
appreciate your confirmation that product selection remains part of 
DOFs procurement strategy that is currently being defined. 

17. Later that same day, Mr. Jackson responded with another question and further 
assurances indicating that the “messaging provider” had not been selected despite the rumors 
heard by Google: 

As for the “disconcerting rumors” you allude to below, I would 
encourage you to treat rumor and innuendo as just that. As I am 
sure you are aware, moving from 13 separate messaging platforms 
to 1 messaging instance is necessarily a traumatic process for many 
of our bureaus. It is one of the challenges of bringing 
transformative change to a very decentralized department. We 
have of course required our bureaus to commence preparations for 
a migration to our new messaging system, and we believe that 
these preparation activities will be useful for a successful 
migration, no matter which messaging provider is ultimately 
selected. If you are being told otherwise, I would request that you 
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recommend that your source contact me directly, so that I can help 
correct any misconceptions. 

18. The next day, June 24, Google responded by thanking Mr. Jackson for his 
assurances that the procurement strategy and product selection were still being evaluated. In 
doing so, Google reaffirmed its sincere interest in competing for DOI’s Messaging requirements. 
Google again explained that DOI’s security requirements can be stated in terms of FISMA 
certifications and controls without requiring a particular infrastructure or computing delivery 
model. Finally, Google notified DOl that its Government-only cloud (federal, state and local) 
had been completed ahead of schedule and was available with the capabilities that had been 
discussed with DOI. 

19. Mr. Jackson did not respond to Google’s June 24 email. On July 19, Google 
attempted to reach Ms. Meffert, the Competition Advocate, by telephone. Ms. Meffert 
responded in an e-mail message that she had no information to provide and that Google should 
speak to Ms. Glass, the contracting officer. Google followed up with Ms. Glass that same day, 
re-emphasizing its interest in competing for DOFs messaging solution requirement. Google was 
told that there had been no developments and that the next step would be the issuance of a 
solicitation. 

20. Google also sent another e-mail to Mr. Jackson on July 26, 2010. In this e-mail, 
Google notified Mr. Jackson that Google Apps had recently been approved as the first suite of 
cloud-computing applications to receive a FISMA certification and accreditation from the 
Government. Additionally, Google continued to express concerns about information it heard 
from market research discussions with other Federal agencies. Specifically, Google alerted Mr. 
Jackson that Google had heard that DOI might soon issue to a competitor (meaning Microsoft) a 
FISMA certification and accreditation for the competitor’s cloud-computing messaging system, 
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even though DOI had repeatedly refused to review Google's FISMA certification package. After 
a week had passed with no response, Google sent another e-mail to Mr. Jackson requesting 
confirmation that DOI was still planning a competitive solicitation, and asking if there were any 
opportunities for Google to pilot or demonstrate its product offering. Mr. Jackson immediately 
responded that all correspondence had to be directed to Ms. Glass. 

21. Google responded later that day to Ms. Glass and Mr. Jackson asking to whom 

t 

discussions should be routed and whether they could discuss any updates, announcements or 
areas of interest. Mr. Jackson again responded only to state that questions should be routed 
through Ms. Glass, who did not respond. 

22. On August 2, 2010, Google sent an e-mail to Mr. Corrington, DOI’s CTO, to 
ensure that he had seen the public announcement that Google Apps was the first suite of cloud¬ 
computing messaging and collaboration applications to receive FISMA certification and 
accreditation. Google also requested confirmation from Mr. Corrington as to DOFs plans for a 
competitive procurement for the selection of a messaging solution. On August 3, Mr. Corrington 
responded by stating that all correspondence and phone calls should be directed to Ms. Glass. 

23. On August 11, 2010, Google reached out to Mr. Jackson and Ms. Glass one more 
time to express Google’s concerns that recent information it had received conflicted with DOFs 
past assurances that Google would have an opportunity to compete for DOFs Messaging 
requirements. Google attached to the e-mail a DOI screen shot, which indicated that a “pilot" 
project to migrate 5,000 DOI users to the Microsoft platform had been underway for months. 
Google explained that the “pilot” would severely harm any future competition and requested that 
DOI conduct a similar test program using the Google Apps solution in order to fairly compare 
the technologies. 
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24. Neither Mr. Jackson, Ms. Glass nor any other DOI official responded to Google’s 
August 11 e-mail. On September 8, 2010, after intervention by DOI’s Office of the Solicitor at 
the request of Google’s counsel, Ms. Glass finally advised Google’s counsel that an RFQ had 
been issued via GSA’s e-Buy and that offers were due within days. 

The RFQ 

25. The RFQ was posted on e-Buy on August 30, 2010. The RFQ requested offerors 
to submit proposals providing hosted e-mail and collaboration services for all DOI bureaus and 
offices. The contract is intended to be a single award, firm-fixed-price Blanket Purchase 
Agreement (“BPA”) awarded against a GSA Federal Supply Schedule. The period ol 
performance will end after five years, unless the maximum dollar threshold of $59.3 million is 
reached first. The RFQ required offerors to submit three proposal volumes: Volume 1 - 
Management/Technical Approach; Volume 2 — Past Performance; and Volume 3 — 

Price/Business. The RFQ’s instructions advised prospective offerors to submit questions or 
comments by noon on September 3, and that the initial due date lor proposal submission was 
September 10, 2010. 

26. The offerors’ Management/Technical Approach proposal, limited to 17 pages, was 
required to “reflect a thorough understanding of the requirements and a detailed description of 
techniques, procedures and tools used for achieving the objectives of the Statement of Work 
(SOW).” The Past Performance proposal, limited to three pages, could include references from 
the Federal government, state or local governments, quasi-government organizations within the 
USA, educational entities, or commercial organizations within the USA within the past three 
years. Those references were required to demonstrate how successful the offerors “have been in 
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the past to complete all aspects of the SOW.” The offerors’ Price/Business proposals were 
required to include a completed pricing table and any associated assumptions. 

27. Section L.9 of the RFQ stated that the Government would make an award to the 
contractor that “represents the best value, price and other factors considered.” The RFQ advised 
that “[technical evaluation factors [were] more important than price; however, between quotes 
that are evaluated as technically equal in quality, price will become a major consideration in 
selecting the successful Offeror.” Section L.8 of the RFQ explained that the Management/ 
Technical Approach would be evaluated based on 1) evidence of infrastructure and specific 
methods for support; 2) the offerors’ described ability to anticipate problems; and 3) the offerors’ 
described standard reports. Past Performance proposals would be evaluated based on evidence 
of success supplying similar services and evidence of the ability to advocate tor client issues 
with a manufacturer. The RFQ did not describe how the Price/Business proposal would be 
evaluated or what the source selection team might consider to evaluate price reasonableness. 
Rather, the RFQ stated that “[w]hen combined, the non-price factors are more important than 
price.” 

28. The SOW set forth the technical requirements applicable to the messaging 
solution. The Background section contained a two-page discussion regarding cloud computing 
and described a “risk assessment” conducted by DOI resulting in DOFs conclusion that it 
required the following attributes of a cloud computing deployment: 

• Compliance with security requirements defined by the Federal 
Information Security Management Act (FISMA) along with 
enhanced DOI-specific security requirements 

• Dedicated data storage infrastructure (both physically and 
logically) to DOI or to DOI and other Federal government 
customers only 

• Dedicated computing infrastructure (both physically and logically) 
to DOI or to DOI and other Federal government customers only 
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• Implementation of at least two data centers located within the 
continental United States. 

• Enterprise e-mail and collaboration services provided by an 
external vendor as a standardized service offering 

29. The stated requirement for an infrastructure that is dedicated to the DOI and other 
Federal government customers only was not explained in the SOW. However, the SOW stated 
that ‘‘extensive market research” led to a determination that the Microsoft BPOS Federal solution 
was “the DOFs product selection of choice.” Further, the SOW explained that a 2002 Microsoft 
standardization decision was reviewed and re-affirmed in an updated standardization memo in 
July 2010. 

30. The requirements outlined by the SOW reflect an emphasis on compliance with 

FISMA security controls. Section 2.1, “Information Security,” provided as follows: 

Underlying all of the requirements described herein is the need for 
DOI to meet the obligation to secure the messaging and 
collaboration system in compliance with the Federal Information 
Systems Management Act (FISMA) ... 

Similarly, Section 10.5, “Security Requirements,” stated that the DOI’s risk assessment resulted 
in a determination the DOI needed to implement a system that was FISMA-compliant, and 
Section 10.5.3 required that “[a]t all times, the Contractor shall comply and the Contractor shall 
cause Microsoft to agree to comply with the [FISMA].” As the SOW acknowledged, the 
Microsoft BPOS-Federal product is not yet FISMA-certified. As such, this essential element 
would be pursued and developed during contract performance. A discussion on how the 
Contractor, Microsoft, and DOI can, at some unknown point in the future, establish the 
technological controls to achieve this critical certification follows in Sections 10.5.3 and 10.5.4. 

31. Significantly, the SOW requirements and even certain terminology were closely 
aligned with Microsoft’s product literature for its Exchange Online, SharePoint Online, and 
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Office Communications Online applications. This was because DOI had defined its needs and 
requirements around the Microsoft products. 

DOI’s Limited Source Justification 


32. The background section of the RFQ’s SOW, described above, was based upon a 
“Limited Source Justification” (“Justification”) executed by the Director of DOI’s Office of 
Acquisition and Property Management, on August 30, 2010. The Justification stated that two 
features of the Microsoft BPOS-Federal suite (consisting of hosting services, Exchange Online, 
SharePoint Online, and Office Communications Online) are critical to DOFs successful 
implementation of a transition from a disparate and disjointed email message system to a 
consolidated and secure system, and form the basis for the Justification. Those features are a 
unified and consolidated email system and enhanced security. 

33. The Justification described DOFs current email implementation, which consists of 

13 systems owned and operated by each bureau and office supporting approximately 85,000 

users, and DOFs failed efforts during 2002-2006 to obtain an e-mail system custom-built by a 

systems integrator to DOFs specifications. After that project was cancelled in 2006, DOI began 

researching other options for a centralized e-mail system. The Justification then described the 

security challenges associated with implementing a department-wide e-mail solution, as follows: 

Underlying the requirement for a functioning email system is the 
need for the Department to universally meet the obligation of a 
secure enterprise messaging, collaboration and storage system. In 
order to maintain a robust approach to achieving its mission, the 
Department requires the ability to seamlessly share, store and 
integrate information in a highly secure environment. This 
requirement is based not only on Federal security requirements; it 
is also based on the diverse functions of DOI. In particular, the 
Department has the primary fiduciary duty to manage tribal trust 
funds and Individual Indian Money (IIM) accounts, as well as the 
resources that generate income for those accounts. The 
Department also has a fiduciary duty to protect procurement and 
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business sensitive communications for itself, its collaborators and 
its customers. Furthermore, the Department has law enforcement 
and investigative authorities, resource protection and management 
authorities (especially with regard to culturally sensitive areas); 
and lab and research authorities which also subject the Department 
to rules and regulations regarding collection, storage and sharing of 
protected information. 

34. Next, under the heading “Identifying Solutions,” the Justification stated as 
follows: 

The commercial market has developed several solutions that may 
better meet the needs of the federal Government as a whole, 
including cloud computing models. Given the rapidly changing 
technical environment, the Department needed to assess what 
model would best meet its current needs. To that end, the 
Department determined that a dedicated private cloud service 
model, combined with robust messaging and collaboration tools 
would best meet its current needs. 

35. Section 3 of the Justification described the specific “supplies or services required 

to meet the agency’s needs.” The first requirement that “must be met by a messaging and 

collaboration system in order to support the DOI mission” was identified as "Core 

Functionality,” described as follows: 

In a standardization memo issued in September 2002, DOI 
established Microsoft Office suite as a departmental standard. In 
July 2010, the standardization decision was reviewed and re¬ 
affirmed through the issuance of an updated standardization memo. 

The Microsoft Office suite includes the Microsoft Outlook e-mail 
client, which provides a full-featured e-mail system that also 
provides calendaring and scheduling functionality. 

36. Seven additional requirements were described in Section 3, including 
“Information Security” headlined by “the need for DOI to meet the obligation to secure the 
messaging and collaboration system in compliance with the Federal Information Systems 
Management Act (FISMA) and other Federal security requirements.” Section 3 concluded by 
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stating that the estimated contract award amount “will be $59 million over the expected five (5) 
year contract life cycle.” 

37. Section 4 of the Justification described DOI’s rationale, under FAR 8.405-6(a)(2), 
for “the acquisition of an item peculiar to one manufacturer.” According to the Justification, 

DOl utilized the “accepted methodology” set out by the Cloud Security Alliance (“CSA”) and 
the National Institute of Standards and Technology (“NIST”) to determine "its risk tolerance for 
implementing current solutions in light of its goals, objectives and mission.” According to the 
Justification: 


Specifically, DOI followed an assessment process recommended 
by the CSA to establish that the following attributes of a cloud 
computing deployment meet DOI’s requirements for the 
implementation of an enterprise email and collaboration system: 

• Collaboration services provided by an external vendor as a 
standardized service offering 

• Ability to comply with security requirements defined by 
FISMA 

• A data storage infrastructure that is solely dedicated (both 
physically and logically to DOI or to DOI and other Federal 
government customers only 

• A computing infrastructure that is solely dedicated (both 
physically and logically to DOI or to DOI and other Federal 
government customers only 

• Implementation at a minimum of two data centers that are 
located within the continental United States 

Significantly, the Justification does not evidence or explain why DOI relaxed its 

requirement from an underlying infrastructure that is o perated solely for DOT as 

expressed by DOI in its May 27, 2010 letter to Google (see Exhibit B attachment 

identifying DOFs stated requirements), to an underlying infrastructure that can be 

dedicated to DOI and any other Federal government customers. 
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38. The Justification stated that DOI had conducted “extensive market research" 
soliciting product and Federal security compliance information from vendors, trusted third-party 
research, and other Federal government informational resources. According to DOI, 
“[m]ethodology included personal knowledge, contacting knowledgeable individuals in 
Government and industry, reviewing recent market research results for similar services, and 
reviewing generally available product literature.” DOI concluded: “Based on this extensive 
market research, the Department determined that although many companies can provide 
messaging services in general, they either cannot provide services that address the complexity of 
messaging requirements within DOI, or they could not meet the degree ot security required by 

DOI.” 


39. The Justification stated the following conclusion: “Based on the risk assessments 
and market research conducted, the Department determined that the Microsoft BPOS solution is 
the only commercial product that satisfies every requirement identified by the Department.” 

The Microsoft BPOS-Federal Solution 

40. There is very little to no publicly-available information about the Microsoft 

BPOS-Federal solution other than a Microsoft press release on its website. The press release 

states that Microsoft announced on February 24, 2010, at its eighth annual Microsoft U.S. Public 

Sector CIO Summit, the unveiling of a number of new enhancements and certifications for its 

BPOS-Dedicated solution and the launch of BPOS-Federal. The press release further stated that: 

Business Productivity Online Suite Federal is launching today for 
U.S. federal government agencies, related government contractors 
and others that require the highest levels of security features and 
protocols. The new offering includes all the certifications and 
security features of the Business Productivity Online Suite and 
more. The service is housed on separate, dedicated infrastructure 
in secured facilities. Physical access to those systems is limited by 
biometric access controls to a small number of individuals who, in 
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compliance with International Traffic in Arms Regulations (ITAR), 
must be citizens of the United States who have undergone rigorous 
background checks, including fingerprinting. 

41. The BPOS-Federal solution is therefore a new product, and there are no publicly- 
identified customers who have either purchased or implemented the BPOS-Federal solution. In 
OMB’s recent report on the State of Public Sector Cloud Computing (available at 
http://www.cio.gov/pages.cfm/page/State-of-Public-Sector-Cloud-Computing') , there are no case 
studies reported of any customer using the BPOS-Federal product. Moreover, as of the date of 
this protest, the BPOS-Federal solution has not been certified according to FISMA standards by 
any government agency at any risk level. Notwithstanding these glaring deficiencies, the DOI 
has concluded that only the BPOS-Federal solution can meet the degree of security required by 
the DOI. 

42. Additionally, even prior to the completion of DOFs test use of the solution, the 
DOI designated BPOS-Federal as the official standard for messaging and collaboration services 
on July 15. This standardization on BPOS-Federal appears to conflict with the Justification’s 
statement that the determination was made in accordance with 375 DM 12, which is DOFs 
departmental manual describing its information resources standardization program. Section 
12.3(A) of the manual provides that the primary objective of the Information Resources 
Standards Program is to “promote compatibility and interoperability to minimize costs for 
information systems.” The BPOS-Federal solution does not uniquely support compatibility and 
is more restrictive of interoperability than other options available to DOI. There are other 
solutions available in the marketplace which are compatible with the Microsoft products selected 
as DOFs official standard in 2002 and are substantially less expensive to the customer than 
BPOS-Federal. 
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43. Moreover, based on publicly-available information gleaned from internet 
searches, Microsoft topped a list of 12 major software providers for the number of security 
vulnerabilities and software patches needed to plug security holes (23% of ‘‘disclosures with no 
patch”) that affect both on-premise and “hybrid" cloud technology. In contrast, Google was the 
only provider on the list with 0% “disclosures with no patch.” The likely reason for this 
difference is that Microsoft BPOS is based on the same Microsoft Exchange and SharePoint 
servers that are made for an on-premise, legacy model so users inherit the same feature refresh 
limitations and patch model/security vulnerabilities. The Google Apps system, on the other 
hand, was built for the cloud from the ground up, providing continuous access to new features, 
faster response to security vulnerabilities, and better real-time collaboration. Only a web 
browser, rather than client software, is required to use the Google Apps solution. Apparently, 
despite its “extensive market research,” DOI did not uncover this information about Microsoft’s 
security vulnerabilities. 

44. DOI also was apparently unconcerned about the numerous outages that Microsoft 
has experienced this year for BPOS-Standard - a January outage lasted nearly four days. The 
two most recent outages occurred on August 23 and September 3 and impacted users throughout 
North America. See http://www.zdnet.com/blog/microsoft/microsoft-bpos-down-for-90-minutes- 
second-outage-in-a-month/7302. Given the DOI’s requirement, as specified in the SOW, for 
99.95% system uptime, Microsoft’s outages this year cast doubt on whether the BPOS-Federal 
solution will satisfy all of DOI’s requirements. 

Google’s GAO Protest 

45. On Friday, September 10, 2010, Google filed a timely protest at the U.S. 
Government Accountability Office (“GAO”) against the RFQ’s restrictive requirement that 
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offerors only propose the Microsoft BPOS-Federal solution and DOI's determination in the 
“Limited Source Justification" that the BPOS-Federal solution is the only product that can satisfy 
DOI’s minimum needs. Google’s protest alleged that DOI’s restriction that the messaging 
solution’s data storage and computing infrastructure be physically and logically dedicated only to 
Federal government customers, which is the primary justification for DOI’s selection of the 
Microsoft BPOS-Federal solution, is not necessary to satisfy DOI’s minimum needs. The protest 
further alleged that Microsoft’s BPOS-Federal product did not satisfy the RFQ’s restrictive 
requirement. 

46. On September 30, 2010, DOI filed with the GAO a request for dismissal of 
Google’s protest on the basis that Google, which does not have a GSA Schedule contract, was 
not an “interested party” as defined in GAO’s Bid Protest Regulations, 4 C.F.R. § 21.0(a)(1). 
Google opposed the dismissal request on October 4, 2010. In addition, Plaintiff Onix filed its 
own protest on October 4 with the GAO to effectively join Google’s protest because of its 
common interest, via its reseller agreement with Google, in challenging DOI’s restrictive 
requirement and seeking an opportunity to compete for DOI’s messaging requirements. Another 
licensed reseller, Daston Corporation, also filed a similar protest on October 4. 

47. On October 25, 2010, the GAO issued its decision dismissing Google’s protest on 
the ground that Google was not an interested party. On October 26, the GAO dismissed the Onix 
protest. It appears that the GAO never docketed the Daston protest. 

COUNT I 

(VIOLATION OF THE COMPETITION IN CONTRACTING ACT AND THE FAR) 

48. Plaintiffs reallege and incorporate by reference the allegations of Paragraphs 1 

through 47 above, as if fully set forth herein. 
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49. Defendant’s implementation of the RFQ, by imposing the selection of the 
Microsoft BPOS-Federal solution for DOI’s agency-wide messaging requirements based on the 
“Limited Source Justification,” without obtaining any sort of product competition, violates the 
statutory requirement of 41 U.S.C. § 253(a) to obtain full and open competition through the use 
of competitive procedures. 

50. Defendant did not comply with FAR 8.405-6 in that DOFs market research, 
consisting in part of many months of communications with Plaintiff Google, established that 
another company's product (i.e., Google’s Google Apps messaging solution) does meet, or can 
be modified to meet, DOFs needs. 

COUNT II 

(AGENCY ACTION IN SELECTION OF MESSAGING SOLUTION IS ARBITRARY, 

CAPRICIOUS, AN ABUSE OF DISCRETION, AND CONTRARY TO LAW) 

51. Plaintiffs reallege and incorporate by reference the allegations of Paragraphs 1 
through 50 above, as if fully set forth herein. 

52. DOFs selection of the Microsoft BPOS-Federal messaging solution, as reflected 
in the “Limited Source Justification” dated August 30, 2010, for implementation throughout the 
agency is arbitrary, capricious, an abuse of discretion, and contrary to law. 

PRAYER FOR RELIEF 

WHEREFORE, Plaintiffs request that this Court enter judgment for Plaintiffs on this 
Complaint for injunctive and declaratory relief prohibiting DOI from proceeding with the RFQ, 
or any related solicitation, task order or activity (such as DOFs current 5,000-user pilot program) 
that furthers or facilities the implementation of the Microsoft BPOS-Federal solution at DOI, 
without first complying with applicable statutory and regulatory requirements, including but not 
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limited to conducting a competitive procurement in accordance with applicable law and 
regulations to select a messaging solution that best satisfies DOI’s minimum needs. In addition, 
Plaintiffs request that this Court afford Plaintiffs such other and further relief as this Court may 
deem just and proper. 


Respectfully submitted, 





Timothy Sullivan 
1909 K Street, N.W., 6 lh Floor 
Washington, D.C. 20006 
(202) 585-6930 (tel.) 

(202) 508-1028 (fax) 


Attorney of Record for Plaintiffs Google, Inc. 
and Onix Networking Corporation 


Of Counsel: 

Katherine S. Nucci 
Scott F. Lane 
Thompson Cobum LLP 

Dated: October 29, 2010 
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May 17, 2010 


VIA ELECTRONIC MAIL 


Ms. Debra Glass 

Chief, Acquisition Management Division IV 
United States Department of the Interior 
Acquisition Services Directorate 
381 Elden St., Suite 4000 
Herndon, VA 20170 

Re: The U. S. Department of Interior’s Pending Messaging Solicitation 


Dear Ms. Glass: 


Google Inc. (“Google”) understands that the Department of Interior (“DOI”) is planning 
to release a solicitation for a department-wide messaging solution (the “Solicitation”) with 
brand-name specific requirements. Google respectfully requests that the Solicitation be revised 
to allow for the offer of our product, Google Apps, as a potential solution. As discussed more 
fully below, we believe Google Apps is a technically-superior and cost-effective solution for the 
DOI’s needs. Notwithstanding our firm views on this issue, recent discussions with DOI 
representatives have indicated that the Solicitation will require using specific Microsoft products. 
We believe these Microsoft-based requirements would violate the Competition in Contracting 
Act because they bear no rational relationship to the DOI’s needs, arc not written to enhance 
competition or innovation, and unduly restrict competition. 


We recognize (hat the formal Solicitation has not yet been released; however, the impact 
of this requirement on our ability to compete makes this an immediate concern. Moreover, 
resolving the concern at this stage could be accomplished easily by ensuring the final Solicitation 
is released without unjustified brand-name requirements. 


I. Google Apps Is A Competitive Alternative For The DOI 

Google Apps is a proven, enterprise-ready solution that is completely interoperable with 
Microsoft software at a dramatically lower total cost of ownership. Even though Google Apps is 
used and trusted by more than two million organizations, the DOI’s arbitrary requirement to use 
only Microsoft-based products would preclude the offer of Google Apps, or any other software 
product that competes with Microsoft. While we obviously do not know the breadth and scope 
of the DOI’s market research (hat preceded the drafting of the Solicitation, it would appear that 
the research did not include an analysis of the most current state-of-thc ail technology or the 
features and benefits that Google Apps has to offer. 
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Market research from even a year or two ago could not have anticipated the technological 
changes experienced in the messaging services market. For example, within the past year, the 
White House has launched a cloud-computing initiative to increase innovation and reduce 
information technology costs. 1 The President’s FY 2010 Budget specifically identifies cloud 
computing as a way "...to optimize the Federal data facility environment and create a platform to 
provide services to a broader audience of customers.” Also within the past year, Google Apps 
has added over 116 new features to help organizations, like the DOI, keep pace with modem 
web-based messaging and collaboration technology. Market research in this environment should 
be constantly assessed and updated to ensure the DOI procures innovative technology at 
competitive prices. 

A current analysis of the features and benefits that Google Apps has to offer would show 
that in addition to e-mail, calendaring and instant messaging, Google Apps offers a suite of 
collaboration tools (such as integrated voice and video chat, web-based documents, easy website 
creation, and access-controlled sharing of documents) that makes employees more productive 
and improves information sharing. And since consumer versions of Google's products are 
globally tested by millions of users, they arc optimized for ease-of-use and to keep training 
requirements to a minimum. In fact, many business users have used cloud-based computing 
services, such as Google Apps, the majority of their lives for personal use. A summary of 
significant benefits provided by Google Apps includes, but is by no means limited to, the 
following: 


• Dramatically reduced cost: GSA pricing is less than $50 per user/year. This 
represents a savings of two-thirds or more based on what most U.S. government 
agencies pay for email today. ' 

• Much more storage: Google Apps has a 25GB inbox, approximately 50 times the 
size of the average DOI email inbox today. 

• Better Collaboration: The platform includes, at no extra cost, document, 
spreadsheet, and presentation tools that provide the capability to collaborate in real 
time. It also includes instant messaging with voice and video chat, a site creation 
tool, and video sharing. 

• Green Technology: Because Google Apps is a cloud-computing solution, agencies 
arc not required to own, maintain, and operate their own servers. This creates a 
significant savings in electric power. For example, the City of Los Angeles estimates 
that it will save over $700,000 per year in electric power and cooling costs alone as a 
result of its adoption of Google Apps. 

Google Apps also delivers reliability and security built on Google data centers, reducing 
infrastructure and maintenance needs while helping agencies establish an effective continuity of 
operations and disaster recovery plans. The security of Google Apps is underscored by the fact 
that its FISMA Certification & Accreditation package submitted to the government is at the 


1 Microsoft Exchange is not a cloud-computing solution, whereas Google Apps was one of the first cloud- 
computing products to be made available on www .Apps.gov. 
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Moderate Impact level which exceeds or equals DOI security requirement. Moreover, Google 
Apps is currently developing a Government-only cloud environment available only for federal, 
state, and local U.S. government customers. This Government-only cloud, planned to be 
operational in time for this procurement, would be hosted completely within the U.S., including 
the primary and backup sites. Google Apps offers many desirable and beneficial features that we 
believe have not been considered, and we would be pleased to provide the DOI with a more in- 
depth description of the product or to provide a presentation of the Google Apps solution to the 
DOI. 

II. Google Apps Can Meet Or Exceed The DOI’s Needs 

Even though Google Apps represents a competitive solution for the DOI’s messaging 
needs, we have been informed that the Solicitation is currently written to exclude our product. 
DOI representatives have claimed that Google Apps is not an option because documentation 
from the DHS led, Trusted Internet Connection (“TIC”) program allegedly does not allow any 
solutions based on multi-tenant architecture. There is no factual support for such a blanket 
assertion and that position is in contrast to the viewpoint of DHS, FedRAMP representatives and 
the Administration’s priorities on the use of cloud computing. Google has requested an 
opportunity to meet with DOI representatives to explain the benefits of Google Apps and to fully 
understand the DOI’s messaging needs; however, Google was told that the path forward has 
already been chosen. 

Other Federal Agencies have recognized that full and open competition based on a 
statement of objectives will most effectively enable their best value decision for messaging 
solutions. NASA recently amended a published RFP for messaging to remove the requirement 
for a specific named product when they realized there are viable options in the marketplace. 
Likewise, DHS has postponed an RFP for messaging which contemplated requiring a specific 
named product when DHS officials realized there are viable options in the marketplace which 
strongly merit detailed review. 

We sincerely appreciate your offer to investigate our concerns. We are very confident in 
our product, and so our questions are targeted to understand what justification the DOI could 
provide to exclude our product. Specifically, we would ask: (i) when and how was the market 
research performed; (ii) whether, how, and to what extent Google Apps was considered; and (iii) 
what justification exists to exclude compatible products that are equal to or better than the brand- 
name? 

III. The Competition In Contracting Act 

The Competition in Contracting Act imposes a duty on agencies to solicit proposals “in a 
manner designed to achieve full and open competition for the procurement.” 41 U.S.C. § 
253a(a)(l)(A). When fulfilling these requirements, restrictive provisions are only allowed in 
solicitations “to the extent necessary to satisfy the needs of the agency or as authorized by law.” 
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FAR 11.002(a)(1)(H). If a requirement is challenged as unduly restrictive of competition, it is 
the agency's responsibility to establish that the specification is reasonably necessary to meet its 
minimum needs. Omega World Travel, Inc., B- 258374, Jan. 13, 1995, 95-1 CPD 20. In 
summary, solicitation terms must have a rational relationship to an agency's minimum needs, 
must be written to enhance competition and innovation, and must not be unduly restrictive of 
competition. CHE Consulting, Inc. v. U.S., 74 Fed.Cl. 742, 747 (Fed. Cl. 2006). 


As detailed above, Google Apps represents a state-of-the-art, secure, and cost-effective 
solution for messaging services that is wholly compatible with Microsoft software. 
Consequently, the pending Microsoft-based requirements bear no rational relationship to the 
DOI’s needs and unfairly preclude our Google Apps product or any other competitive or 
innovative software product. Google should be afforded an opportunity to compete on an equal 
basis. In turn, the DOI will achieve a more robust competition with more innovative solutions. 



Google therefore requests that the Solicitation be released without the unjustified 
Microsoft-based requirements. Additionally, we would suggest that the Solicitation be released 
initially as a draft to receive current industry feedback on the specific terms. We sincerely hope 
that this letter convinces the DOI of Google’s ability to provide an optimum and cost-effective 
solution to meet the agency’s needs and that the unduly restrictive requirement will be removed 
prior to the formal Solicitation in order to foster competition and innovation. We are excited 
about having the opportunity to compete for the DOI’s business, and we arc confident that our 
product will be an effective tool to help the DOI do much more for much less. 


We greatly appreciate your prompt and careful consideration of this request and, again, 
we are prepared to meet with you to further discuss this situation at your earliest convenience. 


Very truly yours 



Michael Lock 
Vice President 
Enterprise Sales 
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June 17, 2010 



VIA ELECTRONIC MAIL 
Honorable J. Andrew Jackson 

Deputy Assistant Secretary for Technology, Information and Business Services 
U. S. Department of the Interior 
Office of the Secretary 
Washington, D.C. 20240 

Re: The U. S. Department of Interior’s Anticipated Messaging Solution Solicitation 

Dear Mr. Jackson: 

Google Inc. (“Google”) greatly appreciates the time taken by you and your 
colleagues to meet with our team on June 9, 2010 to discuss the Department of Interior’s 
(“DOI”) market research and requirements underlying the DOI’s anticipated solicitation 
for a messaging and collaboration systems solution (the “Solicitation”). During that 
meeting, Google explained that our product, Google Apps, could meet or exceed all of 
the agency’s needs 1 , as they were outlined in the DOPs letter to Google, dated May 27, 
2010 (the “DOI letter”). However, considering the complexities of the technology, the 
time constraints of that meeting, and the ideas expressed by some DOI representatives, 
we believe the DOI’s market research remains incomplete. 

Specifically, during the meeting, DOI representatives expressed a preference that 
the messaging system’s physical computing infrastructure be operated solely for the DOI 
(as a “private cloud”) even though this preference was not stated in the DOI letter, would 
dramatically decrease competition and will result in increased costs to the DOI. It 
became apparent to Google that the DOI intends to convert this preference into an 
absolute requirement in the impending Solicitation. Since Google intends to offer 
messaging services hosted in a Government-only cloud, rather than a private cloud, such 
a broad restriction would arbitrarily exclude Google from the competition. 

If the DOI were to perform comprehensive market research to determine what is 
available in today’s marketplace, we firmly believe the DOI will find that a private cloud 


1 We have enclosed a brief summary of how Google Apps meets each of the DOI’s stated requirements. 
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is not necessary to satisfy its needs, as constrained by the Competition in Contracting Act 
(“CICA”). Indeed, if security is the DOI’s true concern, that concern can be fully 
addressed by identifying the DOI’s security requirements in terms of specific 
certifications and controls, such as those defined under the Federal Information Security 
Management Act (“FISMA”). 2 


I. A Private Cloud Is Not Necessary To Satisfy The DOI’s Needs 

The CICA imposes a duty on federal agencies to solicit proposals “in a manner 
designed to achieve full and open competition for the procurement.” 41 U.S.C. § 
253a(a)(l)(A). When fulfilling these requirements, restrictive provisions are allowed in 
solicitations only “to the extent necessary to satisfy the needs of the agency or as 
authorized by law.” FAR 11.002(a)(l)(ii). The GAO consistently sustains solicitation 
protests where restrictive provisions exceed an agency’s minimum needs. For example, 
in The Kohler Company, B-257162, Sept. 2, 1994, 94-2 CPD 88, the agency’s 
solicitation for generators restricted offerors to proposing only 4-cycle engines, as 
opposed to 2-cycle engines. The agency claimed the restrictive provision was justified by 
technical literature describing 4-cyclc engines as “state of the art,” because they 
supposedly generated less pollution, were more fuel efficient, were quieter, and were 
easier to maintain. The protestor presented opposing technical literature stating that the 
two types of engines were equal. The GAO sustained the protest, holding that: 

The competing positions reflected in the technical literature 
relied upon by all of the parties serve to illustrate that, as in 
the 1970s, the “state of the art” in diesel engine design is 
still a matter of controversy in the industry... We need not 
resolve this debate, however, since if environmental, noise, 
fuel consumption, and reliability issues arc concerns of 
[agency], specifications for such parameters can easily be 
drafted without requiring a particular engine design. 

Similarly, in Dala-Team, Inc., B- 233676, April 5, 1989, 89-1 CPD 355, the 
GAO sustained a protest where the agency had drafted its requirements based on 
preconceived notions. In that case, a solicitation requirement that copiers use dry toner 
was challenged as unduly restrictive of competition. The agency asserted that the 
requirement was related to its need to relocate the copiers quickly without leakage of the 
toner. The agency had decided to exclude liquid toner machines based on its prior 
experience with out-dated machines that had leaked. However, the protester was able to 


A 

For example, the General Services Administration (“GSA”) just issued Solicitation No. OCIO-14558 for 
Enterprise E-Mail and Collaboration Services for purposes of acquiring “e-mail and collaboration services 
as Software as a Service (SaaS) from a commercial provider of Cloud Computing services and software. 
The GSA’s Statement of Objectives requires that the contractor “provide security controls that are 
confirmed to meet the security standards for Moderate Impact systems as described in NIST SP 800-53 
with an accepted Certification and Accreditation (C&A).” If the DOI stated its requirements using similar 
language, our concerns would be alleviated and the agency and taxpayers would benefit from a much more 
robust competition. 
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show that justification to be unreasonable because copier technology had advanced to a 
state where even liquid toner machines could be relocated quickly without leakage or 
spillage of the toner. The GAO recommended that the solicitation be amended to address 
the need for copiers that could be quickly and easily moved, without eliminating all 
liquid toner copiers from the competition. 

Google understands that, similar to the engine design debate addressed in The 
Kohler Company decision, there may be competing technical literature related to various 
computing infrastructures. 3 That debate cannot be resolved unilaterally by the DOI 
without a competition, certainly not when real technical parameters could easily be 
drafted (ala the recent GSA solicitation) without limiting competition to a specific 
infrastructure for the messaging solution. Further, even if the DOI has experience with 
various messaging infrastructures, the technology is rapidly advancing, such that a broad 
exclusion based on preconceived notions, as in Data-Teanh Inc., would be arbitrary. If 
the DOI is concerned about the security of the messaging system, the DOI should draft 
technical requirements based on FISMA certifications and controls — like the security 
requirements specified in the GSA solicitation — without requiring a particular 
infrastructure or computing delivery model. 4 This will not only enable a more robust 
competition, but it will help to ensure that the DOFs true needs are satisfied through the 
Solicitation’s specifications. 5 

II. Standardization Decisions Are Not Exempt From C1CA 

Despite the apparent gaps in the DOFs market research, we understand that the 
DOI had already defined a procurement strategy and requested bureau migration plans 
prior to the June 9 meeting with Google. We understand that this previously developed 
procurement strategy is somehow based upon a purported “Standardization Authority” 
related to a 2002 DOI memorandum. We are very troubled by the contrast between the 
DOFs public statements promising full and open competition and what we understand is 
actually happening behind the scenes. 


3 The current version of the National Institute of Standards and Technology’s (‘N1S 1 **) definition of 
“cloud computing,” version 15, provides that: “Cloud computing is still an evolving paradigm. Its 
definitions, use cases, underlying technologies, issues, risks, and benefits will be refined in a spirited debate 
by the public and private sectors. These definitions, attributes, and characteristics will evolve and change 
over time." Notably, although the NIST definitional documents elaborate on the different types of cloud 
models, no specific cloud model is listed as being more secure than any other. 
http://c.src.nist.gov/grouns/SNS/cloud-computinR/cloud-def-vl5.d()c 

4 The Google and Microsoft cloud solutions are both being certified by FISMA at the “moderate" level - 
demonstrating equivalency in security as judged by the NIST 800-53 security controls and the NIS1 800-37 
risk management framework. 

5 Based on discussions at our June 9, 2010 meeting, we presume security is the concern underlying the 
requirement for a private cloud, but the concept of drafting technical requirements that express underlying 
needs is applicable to any other concerns the DOI may have as bases for justifying its perceived need for a 
private cloud. 
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Standardization decisions do not exempt procurements from the CICA’s 
competition mandate. For example, in Savantage Financial Services, Inc. v. United 
States , 81 Fed. Cl. 300 (2008), the Department of Homeland Security (“DHS”) attempted 
to standardize its financial management system software by expanding its existing 
contracts with two specific vendors rather than holding a full and open competition. The 
Court of Federal Claims sustained the ensuing protest by Savantage, whose financial 
management software was being used by multiple DHS components, on the basis that the 
DHS never conducted a competitive procurement to support its standardization decision 
and it could not otherwise justify the sole-source award under CICA. 

Here, even assuming arguendo that the DOI conducted a competition or valid 
sole-source justification that pre-dated the 2002 memorandum, that eight-year old 
memorandum has no logical nexus to the current market for messaging services. The 
field of competition, the technology, the product packages, the security, the 
interoperability, and costs have all drastically changed in the past eight years. It would be 
unreasonable to rely upon that memorandum to justify a sole-source award today. 
Moreover, we again point out that previous investments in Microsoft products would not 
be lost because Google Apps is interoperable with Microsoft software. 

III. A Private Cloud Does Not Necessarily Reflect “Industry Best Practice” 

During the June 9 meeting, you expressed the view that the DOI’s requirement for 
a “private cloud” was based on the DOI’s “business needs” and on “industry best 
practice.” Although those DOI officials present at the meeting declined to elaborate on 
the nature of the DOI’s “business needs,” we believe that the foregoing discussion 
demonstrates that those needs can be satisfied just as well with a FISMA certified and 
accredited “Government-only” cloud such as that offered by Google. Regarding what 
represents “industry best practice,” we believe several points arc worth mentioning that 
undermine the DOI’s apparent belief that a “private cloud” infrastructure represents such 
practice. 

First, Google has active federal customers today, the U.S. Department of Energy 
(“DOE”) and the U.S. Department of Education, using our cloud technology in 
production. Interestingly, according to a recent OMB report on the “State of Public 
Sector Cloud Computing” throughout the Federal Government, Microsoft does not claim 
to have any references for its “private cloud” BPOS-Federal messaging product. 

Second, more than 50,000 companies, including 15% of the Fortune 500, use 
Google’s cloud-based, anti-spam, anti-virus capability. Major organizations such as 
Motorola, Seagate, Mead-WestVaco, and Land Rover Jaguar, the City of Orlando, City of 
Los Angeles, and the DOE use Google Apps for messaging and collaboration services. 
None of these Google solutions is classified as a “private cloud.” 

Finally, it is ironic that the DOI operates the National Business Center (“NBC”), 
whose operations and business model arc based on cross-servicing IT applications, such 
as payroll and other financial management functions, for numerous federal agencies in a 
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multi-tenant environment. If the NBC’s customers had a requirement for a “private 
cloud,” those agencies would be prohibited from using NBC’s services. 

IV. Conclusion 

We trust this letter makes it clear that Google is sincerely interested in the 
opportunity to compete for the DOI’s business and that we believe our Google Apps 
product would more than satisfy the DOI’s needs in an extremely cost-effective manner. 
We therefore respectfully request that you thoroughly examine the justifications 
underlying the DOI’s preference for a “private cloud” before issuing a solicitation that 
restricts competition. As we have stated, if security concerns are the real issue, we urge 
the DOI to include security requirements in the Solicitation that arc written in terms of 
FISMA certifications and controls. In this regard, we would suggest that the Solicitation 
be released initially in draft form for purposes of obtaining current industry feedback on 
the Solicitation’s terms. 

We greatly appreciate your prompt and careful consideration of this request and, if 
you believe it would be helpful, we are prepared to meet with you and your colleagues at 
your earliest convenience to explain and demonstrate the similarities - and advantages - 
of using our Government-only cloud as compared to a private cloud infrastructure. 


Veiy truly yours, 



Michael Lock 
Vice President 
Enterprise Sales 


Enclosure - Google’s Responses to the DOl’s May 27, 2010 requirements 
Cc: Ms. Debra Sonderman 

Director, Office of Acquisition and Property Management and Senior Procurement 

Executive 

United States Department of the Interior 
Office of the Secretary 
Washington, D.C. 20240 

Cc: Ms. Brigitte Meffcrt 

Department Competition Advocate 
U.S. Department of the Interior 
Office of the Secretary 
Washington, D.C. 20240 

Cc: Ms. Debra Glass 

Chief, Acquisition Management Division IV 
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U.S. Department of the Interior 
Acquisition Services Directorate. 
381 Elden St., Suite 4000 
Herndon, VA 20170 


Cc: Mr. William Corrington 

Chief Technology Officer 
U. S. Department of the Interior 
Office of the Secretary 
Washington, D.C. 20240 

Cc: Mr. Bernard Mazer 

Chief Information Officer 
U.S. Department of the Interior 
Office of the Secretary 
Washington, D.C. 20240 
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Enclosure 

Google’s Responses to the DOI’s May 27, 2010 Questions 

Google received a letter from the DOl asking Google to address how the Google Apps 
solution meets each of the following DOI requirements. During a follow up meeting on June 9, 
2010, Google explained that Google Apps could meet each of those requirements. A summary 

of Google’s responses is provided below. 

DOI Requirement 1: Ability to support Microsoft Outlook as the client email application 

Google Response: YES. Google Apps Sync for Microsoft Outlook® is a Microsoft Outlook® plug 
in that lets you use Microsoft Outlook® as a client for Google Apps email, calendar, and 
contacts. Email, calendar events (including recurring meetings), and contact information are all 
synchronized between Google Apps and Microsoft Outlook®. Google's tool is a MAPI based 
plug in for increased functionality through native integration. 

DOI Requirement 2: Ability to support web-based access to email 

Google Response: YES Google Apps supports web-based access to email which includes unique 
capabilities to improve efficient and effective communication from any web enabled device. 

DOI Requirement 3: Ability to directly integrate (not synchronize) with DOl’s 
implementation of Active Directory for identity management, user authentication, and user 

authorization. 

Google Response: Yes.. Google can meet the DOI requirement. Google supports Single Sign-on 
(SSO) via the SAME 2.0 speciftcation/standard. Google continued to explain that there are a 
number of enterprise companies that are using SSO which defers the authentication step to the 
customer infrastructure. There are number of commercial SSO implementations that can 
integrate directly with MSFT Active Directory to include Ping Identity. 

DOI Requirement 4: Ability to provide an underlying infrastructure that is operated solely 
for DOI 

Google Response: Yes. The service for DOI can be isolated to a single domain run on a logically 
separate network. Further Google can run service for DOI in a dedicated cloud run for U.S. 
Government customers only. 

DOI Requirement 5: Ability to meet FISMA security certification requirements 

Google Response: Yes. Google is the first company to submit its complete Certification and 
Accreditation package to the General Services Administration. GSA expects to issue an ATO for 

Google Apps by June 30, 2010. 
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Google’s Responses to the DOI’s May 27, 2010 Questions 

DOI Requirement 6: Procedures for responding to security and privacy breaches including 
reporting requirements defined in OMB Memorandum M-07-16 

Google Response: Yes. This is documented in the Security Package supporting our F1SMA 
accreditation. Documentation has been available for review on an ongoing basis to appi opi iate 
DOI employees. "Google reports security incidents to the U.S. General Services Administration 
in accordance with the response procedures and criteria agreed-upon with GSA. These 
procedures are documented in Appendix F 'Handling IT Security Incidents for U.S. Government 
Customers ’ of the Google Apps Premier Edition System Security Plan. GSA coordinates the 
notification of any incidents with applicable U.S. government stakeholders including end-user 
agencies and US-CERT. GSA facilitates the communication between Google and U.S. 
government agencies to ensure an efficient and coordinated response. 

DOI Requirement 7: Ability to provide financially-backed uptime commitments 

Google Response: Yes. Further, Google leads the industry in messaging service uptime and 
supplies all enterprise customers with a financially backed SLA. 

DOI Requirement 8: Ability to provide blackberry services including: 

• Implementation of Blackberry Enterprise Server (BES) within the Google 
infrastructure 

• Ability to require the use of FIPS 140-2 encryption on Blackberry devices 

• Ability to set security policies for password length, complexity, retention, etc. 

• Ability to support other mobile devices, specifically iPhone, Android and Windows 
Mobile 

Google Response: Yes. DOI clarified their objective to not have any messaging infrastructure on 
premise at DOI and Google confirmed this can be supported. Further, with regard to other 
mobile devices, Google Apps provides users with seamless access to information regardless of 
location or device. These include iPhone, Android and Windows Mobile devices. Google 
provides the Active Sync service to maintain enterprise level security and administration and 
controls for both iPhone and Windows Mobile devices, http://googleenterprise.blogspot.com/ 
2010/02/google-apps-adds-enterprise-admin_03.html 

DOI Requirement 9: Ability to integrate with SharePoint and other document 
collaboration and sharing tools 

Google Response: Yes. Google Apps provides high fidelity interoperability with industry 
standard document and collaboration tools which can expand or augment existing capabilities. 
In addition, Google Apps delivers many unique features and functions which will provide DOI 
new innovations for improving efficiencies and effectiveness of collecting, creating, and sharing 
information internally and externally. 
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Enclosure D oi’s May 27,2010 Questions 

Soogle’s Response ^ and desktop video 
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